Crossfoot
Crossfoot / Controls / Personnel screening, terms and sanctions
Draft v0.1.06 of 6 frameworks

Personnel screening, terms and sanctions

Background screening before hire, security obligations in employment terms, and a disciplinary process.

Where it appears

SOC 2
CC1.4Hiring and competence practices
CC6.3Removes access on termination
PCI DSS 4.0
12.7Personnel are screened to reduce risks from insider threats
NIST CSF 2.0
GV.RR-04Cybersecurity is included in human resources practices
ISO 27001:2022
A.6.1Screening
A.6.2Terms and conditions of employment
A.6.4Disciplinary process
A.6.5Responsibilities after termination or change of employment
HIPAA Security Rule
164.308(a)(3)(ii)(B)Workforce clearance procedure
164.308(a)(3)(ii)(C)Termination procedures
164.308(a)(1)(ii)(C)Sanction policy
NIST 800-53 r5
PS-3Personnel screening
PS-4Personnel termination
PS-8Personnel sanctions

Evidence auditors usually ask for

A typical starting list. Your assessor's request list is the one that counts.

  • Background check policy and completion evidence for a sample of new hires
  • Signed confidentiality / acceptable use agreements
  • Disciplinary or sanctions policy
  • Offboarding checklist with asset return and access removal

Crosswalks that include this

SOC 2 to PCI DSS 4.0SOC 2 to NIST CSF 2.0SOC 2 to ISO 27001:2022SOC 2 to HIPAA Security RuleSOC 2 to NIST 800-53 r5PCI DSS 4.0 to SOC 2PCI DSS 4.0 to NIST CSF 2.0PCI DSS 4.0 to ISO 27001:2022PCI DSS 4.0 to HIPAA Security RulePCI DSS 4.0 to NIST 800-53 r5NIST CSF 2.0 to SOC 2NIST CSF 2.0 to PCI DSS 4.0